Visibility is not enough

How do breaches happen? Often, it isn’t because an attacker has been especially inventive. Instead, breaches often occur because organisations fail to notice what’s already in front of them: a permissive rule left unchallenged, a forgotten account still active, or a firewall policy that no one has reconciled in years. When teams talk about “visibility,” they are really describing these blind spots: the places where risk quietly grows until it is too late to do anything about it.

 

The trouble is that “visibility” has been framed as the ultimate objective in itself. More dashboards to manage, more metrics to track, longer reports to sift through. But none of these improvements in visibility actually address the underlying weaknesses, because seeing more is not the same as controlling more.

 

Visibility is not unimportant, but it is also not the end state. Let’s reframe the focus on visibility and ask what happens in its absence: the misconfigurations that remain undetected, the policy sprawl that grows unchecked, and the business initiatives that never get launched because risk cannot be assessed in time. Seeing is just the starting point. What comes after is what really matters.

 

When blind spots become business problems

It is tempting to frame visibility as a goal in itself, but it rarely secures attention on those terms. Executives do not allocate budget because the security team wants clearer dashboards. The real impact comes when visibility gaps create consequences that no one can ignore: breaches that should have been contained, audits that fail for want of evidence, or projects that stall because security decisions cannot be made quickly enough.

 

Without a clear view of policies and configurations, small oversights grow into systemic weaknesses. Rules remain in place long after they’re needed, opening paths that were never intended. Privileged accounts continue to exist months or years after their purpose has passed. Access controls overlap or contradict one another, creating uncertainty about what is actually allowed. These are the kinds of gaps attackers rely on.

 

The same lack of clarity undermines compliance. Take PCI DSS v4.0, which became mandatory in 2025. It requires organisations handling payment card data to show active control over their security policies – not just that policies exist, but that they are monitored, enforced, and updated in line with risk. That includes proving least-privilege access is maintained, demonstrating that firewall and segmentation rules are reviewed regularly, and showing that changes are documented and validated. Without reliable visibility into what rules allow, who approved them, and whether they remain valid, providing that level of evidence becomes impossible. The result is more than a failed audit; organisations are exposed to regulatory scrutiny and reputational damage.

 

Perhaps the most overlooked consequence, however, is the effect on agility. Every application rollout, every infrastructure upgrade, every urgent fix depends on a quick and confident security decision. If visibility gaps force extended risk assessments, projects cannot push ahead. Security becomes a brake on progress rather than a source of assurance. In industries where time to market defines competitiveness, that is not a position any business can sustain.

 

Static rules in dynamic environments

These problems are amplified by the pace of change in modern infrastructure. Networks are dynamic, workloads move across multiple clouds, and containers can appear and disappear in seconds. A quarterly review or a point-in-time audit offers no more than a snapshot of an environment that has already changed.

 

Static rules cannot keep pace with that churn. As environments evolve, policies sprawl. Firewall rules, cloud access lists, and segmentation policies are created in different domains, often as quick fixes to urgent issues or to accommodate legacy systems. Over time, layers of rules accumulate until no one can say with certainty which are still relevant and which are obsolete. At that stage, the problem is not a missing dashboard. It is a lack of coherent governance.

 

This incompleteness is again where attackers find opportunity. A single outdated rule may create an entry point, or a forgotten service account may offer a foothold. A conflict between overlapping policies may create ambiguity that no one has the confidence to correct. The issue isn’t just what you can’t see but how quickly those blind spots turn into something exploitable.

 

From seeing to acting

The real value of visibility is in what it enables. Spotting a misconfiguration only matters if it can be fixed before it becomes systemic; identifying excessive permissions is helpful only if they can be removed without delay; and understanding the impact of a change makes a difference only if it allows the business to keep moving, rather than forcing it to wait.

 

That means treating policies not as static rules but as living assets: monitored continuously, reconciled across domains, and adapted in line with how the organisation actually operates. Visibility provides the raw material. What defines maturity is the ability to act on it at the speed required.

 

“We don’t have visibility” has become the stock phrase whenever security work runs into trouble. Yet this explains everything and nothing. The words fill the space where the real diagnosis should be – why an attacker moved through the network unnoticed, why evidence couldn’t be produced under audit, why the pace of change fell behind the needs of the business. As a justification, it is too easy. As a strategy, it is empty.

 

The real question is what happens once those blind spots are identified. A single rule left unchecked can distort the whole policy environment, creating uncertainty about what is safe to change and what is untouchable. Teams begin to hesitate – not because they lack skill, but because they lack confidence in the picture in front of them. Over time, that hesitation slows the organisation more effectively than any adversary could.

 

That is why visibility on its own is never the story. The real story is whether an organisation can take what it sees and act decisively. The test is not the number of dashboards on display but the ability to use them to correct drift, enforce intent, and keep the business moving. 

 

---

 

David Brown is SVP International Business at FireMon

 

Main image courtesy of iStockPhoto.com and bymuratdeniz